Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

Howto Migrate 4 splunk 5.x index servers to 2 splunk 6x index servers

0

Hi splunkers, I've got 4 version 5 indexers across two datacenters, and i want to move them to 2 new version 6 index-cluster (2 on each datacenter). Today any index in data is spread across all 4 servers, but target topology would be only 2 (+ replication)

How would I go about to migrate eksisting data to the new servers (i've no problem doing the classic "move to new indexer"), but this is a bit different, since I'm reducing number of indexers.

People who like this

1 Answer

This could get a bit tricky real fast. I did something similar about a year ago but it was a 1:1 migration for hardware refresh. You can try the old fashioned way of copy/paste, assuming none of the index files are named the same on the separate servers, then just remove the bucket manifest file before starting Splunk up for the first time.

Hi thanks for input. I've checked with peers also, and the consensus i to just migrate data to new servers. The non-replicated data will be searchable until their frozen. New data will be replicated across the cluster